build: migrate from npm to pnpm

Ten git worktrees each carried their own 225 MB node_modules (1.1 GB across
five) and paid 11s per `npm ci`. pnpm hardlinks from a shared store: the same
five worktrees cost ~250 MB total, and a fresh install is 4s.

What changed beyond the mechanical rename:

- `overrides` moved to `pnpm-workspace.yaml`. pnpm 11 does not read the `pnpm`
  field in package.json *or* npm's top-level `overrides`, and it fails silently
  — the vite/defu/language-server pins would have quietly stopped applying.
- Build scripts are blocked by default in pnpm; esbuild and sharp are allowed
  explicitly via `allowBuilds` (renamed from `onlyBuiltDependencies` in 11).
- `packageManager` + `engines` pin the toolchain.
- gate.sh rejects a package-lock.json/yarn.lock/bun.lock outright, so an agent
  running `npm install` out of habit fails loudly instead of building a second,
  divergent dependency tree.
- CI bootstraps pnpm with `npm install --global pnpm@11.25.0` rather than
  corepack (unbundled as of Node 25) or pnpm/action-setup (this self-hosted
  act-runner has never run a job; fetching a third-party action is not
  something to discover on the first one).

Two pre-existing CI bugs fixed while in the file:

- the gate installed with `npm install --package-lock=false`, which discarded
  the lockfile the previous session had just fixed.
- the visual-regression step imported `playwright`, which is not a dependency,
  and `visual-regression.mjs` has no compare mode anyway — in CI it overwrote
  its own baselines and passed unconditionally. Removed with a comment; it
  comes back when it can diff.

The `publish` job is now manual (`workflow_dispatch`). During the migration
dist/ holds three HTML files against the live pages branch's ten, so publishing
on every push to main would take the site down to a stub. Restore at task 20.

HANDOVER.md's incident log still says npm where it describes what happened at
the time; that is history, not a missed rename.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/agents/content-i18n-migrator.md

@@ -1,19 +1,23 @@
 ---
 name: content-i18n-migrator
-description: Moves bilingual copy out of app.js and catalog.js into typed Astro content collections without altering a string. Use for tasks 03-04 and any later content relocation. Do not use for markup or styling.
+description:
+  Moves bilingual copy out of app.js and catalog.js into typed Astro content
+  collections without altering a string. Use for tasks 03-04 and any later
+  content relocation. Do not use for markup or styling.
 tools: Read, Write, Edit, Bash, Grep, Glob
 ---
 
 You own `src/content/` and `src/content/config.ts`, and you are their only
 writer. Your job is a lossless move, not an edit.
 
-**Read first**: `.agents/rules/content-i18n.md`. **Load skill**: `content-migration`.
+**Read first**: `.agents/rules/content-i18n.md`. **Load skill**:
+`content-migration`.
 
 ## What you are moving
 
 ~50 `{ en, pt }` keys from `app.js` (`phases`, `handsOnPrompts`, `modelGuide`,
-`skillSources`, `skillInstallPrompts`), plus 24 review entries from
-`catalog.js` and `submitted-catalog.js`.
+`skillSources`, `skillInstallPrompts`), plus 24 review entries from `catalog.js`
+and `submitted-catalog.js`.
 
 These are hand-written translations with deliberate tone. **Copy them
 mechanically. Never retype.** Retyping introduces drift nobody notices until a
@@ -21,9 +25,9 @@ Portuguese speaker does.
 
 ## Procedure
 
-Extract → write into collection → diff extracted-before against
-extracted-after → only then delete the source. If the diff is not empty, you
-changed content. Fix it before continuing.
+Extract → write into collection → diff extracted-before against extracted-after
+→ only then delete the source. If the diff is not empty, you changed content.
+Fix it before continuing.
 
 Both locales required in the schema. A missing `pt` must be a **build error**,
 never a silent English fallback — that is how bilingual sites quietly become
@@ -35,11 +39,12 @@ monolingual.
 `scripts/build-skill-review.mjs` and the output is **committed**. Move
 `catalog.js` and the generator keeps running against nothing — silently. Either
 re-point it or replace it, and update `package.json`, `README.md`,
-`docs/operations-guide.md`, and the review desk footer, all of which reference it.
+`docs/operations-guide.md`, and the review desk footer, all of which reference
+it.
 
-Also: the review desk's diff view compares original and improved **source text**.
-If you convert `improved` to rendered Markdown, keep the raw string available or
-the diff view breaks.
+Also: the review desk's diff view compares original and improved **source
+text**. If you convert `improved` to rendered Markdown, keep the raw string
+available or the diff view breaks.
 
 ## The language-switching decision
 
@@ -50,4 +55,4 @@ a decision, record it. Either way `<html lang>` tracks the active language.
 ## Done when
 
 The string diff is empty, both locales validate, the generator still produces
-identical output, and `npm run verify` is green.
+identical output, and `pnpm run verify` is green.